CVE-2026-18572: Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes
A vulnerability was found in Keycloak where authenticated users can bypass authorization services time policies. When requesting a User-Managed Access (UMA) permission, a caller can supply a claim token containing forged kc.time.datetime values. Keycloak merges these caller-supplied claims after the server-generated time attributes, allowing the forged values to overwrite the server clock during policy evaluation. This allows an attacker to obtain Resource Permission Tokens (RPTs) outside of the time windows configured by administrators, effectively defeating temporal access controls such as maintenance windows or off-hours access denials.
Other sources
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify Keycloak configuration/behavior for UMA permission requests so that when a caller supplies a claim token, any kc.time.date_time values are not merged after the server-generated time attributes; forged values must not overwrite server clock time-policy evaluation attributes.
Keycloak Authorization Services (UMA claim token handling) kc.time.date_time (caller-supplied claim) = ignored (do not allow to override server-generated time attributes) - Compensating control
Ensure the authorization endpoint that issues Resource Permission Tokens (RPTs) for Keycloak Authorization Services does not accept/merge caller-supplied claim values for time-policy evaluation attributes (e.g., block or ignore forged kc.time.date_time from UMA claim tokens) so that only server-generated time attributes are used during policy evaluation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18572?
CVE-2026-18572 has a severity rating of medium, with a score of 6.5.
How do I fix CVE-2026-18572?
To fix CVE-2026-18572, update Keycloak to the latest version that addresses this vulnerability.
What is the impact of CVE-2026-18572 on Keycloak?
CVE-2026-18572 allows authenticated users to bypass authorization time policies, which can lead to unauthorized access.
Who is affected by CVE-2026-18572?
All users of Keycloak who rely on User-Managed Access (UMA) permissions may be affected by CVE-2026-18572.
When was CVE-2026-18572 published?
CVE-2026-18572 was published on July 31, 2026.